diff --git a/doc/src/sgml/release-14.sgml b/doc/src/sgml/release-14.sgml
index 820855580d..90019bd0ff 100644
--- a/doc/src/sgml/release-14.sgml
+++ b/doc/src/sgml/release-14.sgml
@@ -41,6 +41,50 @@
+
+ Tighten security restrictions within REFRESH MATERIALIZED
+ VIEW CONCURRENTLY (Heikki Linnakangas)
+
+
+
+ One step of a concurrent refresh command was run under weak security
+ restrictions. If a materialized view's owner could persuade a
+ superuser or other high-privileged user to perform a concurrent
+ refresh on that view, the view's owner could control code executed
+ with the privileges of the user running REFRESH.
+ Fix things so that all user-determined code is run as the view's
+ owner, as expected.
+
+
+
+ The only known exploit for this error does not work
+ in PostgreSQL 16.0 and later, so it may
+ be that v16 is not vulnerable in practice.
+
+
+
+ The PostgreSQL Project thanks Pedro
+ Gallegos for reporting this problem.
+ (CVE-2024-0985)
+
+
+
+
+